The Complete Course of NIST Risk Management Framework RMF

Identify risk management rules and shape an organization-wide RMF strategy. Develop organization-wide risk assessments and continuous monitoring with tailored baselines.

Identify and publish organization-wide common controls for inheritance, detailing inputs and outputs; apply impact level prioritization (P6) and continuous monitoring strategy (P7) within the NIST RMF.

Explore system level tasks P8–P11 in the NIST RMF. Identify mission focus, stakeholders, assets, and the authorization boundary to secure the system lifecycle.

Identify information types and their lifecycle, conduct system risk assessments, define security and privacy requirements for P12–P18, and align them with enterprise architecture and system registration under the RMF.

Explore the roles and responsibilities across the NIST RMF framework, from authorizing officials to CIOs and enterprise architects, outlining organizational and system level duties in RMF steps.

Explain the roles of the system security or privacy officer and the system privacy or security engineer, including collaboration with the system owner on policies and risk assessments.

Apply the prepare step tasks 1–18 to the Einherjer labs case study to perform a security and privacy risk assessment for the Yggdrasil app.

Navigate the prepare step in the NIST RMF through quiz questions on roles, references, and risk assessment responsibilities.

Document the system description for the categorize step, detailing system characteristics, required inputs, and responsibilities of the system owner and supporting roles across lifecycle phases.

Identify security categorization for information systems using FIPS 199, SP 800-60 and RMF. Document inputs, high watermark, information types, and approval by system owners and authorizing officials.

Assess information types to set information system category using the high water mark for confidentiality, integrity, and availability; define the authorization boundary and apply P11–P13 with SP 837 rev. 2.

Demonstrate preparing a security categorization document for information types, referencing SP 860, volume two, assigning provisional impact levels, and rationalizing changes to confidentiality, integrity, and availability.

Answer quiz questions on categorizing systems in the NIST RMF. Identify who is primarily responsible, how security category and impact level shape documentation, and the correct categorization sequence.

Explore the select step of the NIST RMF: choose, tailor, and allocate controls, baselines, common controls, system-specific controls, and hybrid controls, with risk-informed tailoring, monitoring, and plan approvals.

Document planned control implementations and develop security and privacy plans for the system and environment of operation, covering common and hybrid controls. Coordinate continuous monitoring with organizational policies.

Learn how the NIST RMF selects and tailors security and privacy controls, using control baselines, overlays, and enhancements to meet organization-specific risk, environment, and PII protection needs.

Select the initial control baselines after categorizing the system, then tailor, supplement, and allocate controls and document them in the system security plan and the security and privacy plans.

Engage in a practical case study to select and tailor NIST RMF controls for the Valkyrie information system, build a sample SSP, and compare FedRAMP and 853 baselines.

Master the selection, implementation, and monitoring of security and privacy controls under the NIST RMF, including common and hybrid controls and the high watermark concept.

Implement security and privacy controls as documented in the security and privacy plans, and record the as-implemented configuration as the baseline.

Implement controls using existing or new processes, guided by system security and privacy plans through software development life cycle. Leverage sp 870 rev 4 and stigs to configure it products.

Explore the implement step of the NIST RMF through a hands-on case study on the Valhalla system, implementing controls with the SSP, applying STIG-based system hardening, and refining configuration settings.

Navigate the implement step of the RMF quiz, clarifying control responsibilities, suitable publications, and the correct sequence of selecting, tailoring, implementing, approving, and updating controls.

Learn how the assess step validates security and privacy controls are implemented correctly and operate as intended, detailing assessor selection, assessment planning, assessments, remediation, and plan of action and milestones.

Validate security and privacy controls across the system development life cycle through control assessments using assessment plans and evidence. Document findings, remediate deficiencies, and develop plans of action and milestones.

Explore a flexible framework for assessing security and privacy controls, creating assessment plans, and using plan of action and milestones to guide prioritized remediation.

The lecture explains assessing controls for a sample system using security assessment plans (SAPs) derived from the SSP, privacy plan, and control documentation, with FedRAMP and NIH templates.

Explore the assess step in the NIST RMF, verifying controls meet requirements to inform risk-based decisions. Understand independence, required information, plus outputs like reports and plans of action and milestones.

Authorize step six explains compiling the authorization package, performing risk analysis and risk determination, and issuing an authorization decision for information systems with security, privacy, and common controls considerations.

Identify and implement the preferred risk response, balancing mitigation and acceptance, reassess controls, and obtain authorization to operate or use common controls through ongoing monitoring and reporting.

Learn how the authorizing official uses risk information from the authorization package, security and privacy plans, and control assessments to make risk-based authorization decisions for operating or using systems.

Review the authorizing package, including the SSP, POA&M, and security assessment report, verify controls and residual risk, and decide on authorization to operate.

Review the authorization package components, understand how authorization decisions are made, and identify event-driven triggers that prompt reevaluation in the RMF.

Engage in continuous monitoring to maintain ongoing awareness of the security and privacy posture of the information system and organization, guiding risk management decisions.

Learn to manage risk through ongoing monitoring, update authorization packages, and report security posture; implement near real time risk management, ongoing authorization, and system disposal procedures.

Discover continuous monitoring strategies for information systems, including privacy and information security monitoring across the organization. Learn how automated tools enable vulnerability, asset, and configuration management with siem dashboards.

Understand ongoing assessment and authorization in the rmf, leveraging ecm and imf to adjust controls and maintain poams, ssp, and risk documentation.

Explore continuous monitoring and plan of action and milestones within the NIST RMF, using automation to detect issues and update the system security plan with current control families.

this course recaps the rmf steps and key concepts, highlighting customization, alignment with cybersecurity standards, scalability, and a proactive risk-management approach with free resources.